How to use this checklist
Use a properly authorised administrator account and record changes. The controls available depend on the licences in use, so confirm current Microsoft documentation before changing production settings.
Important principles
- ✓Multi-factor authentication reduces the value of a stolen password.
- ✓Administrator accounts have greater impact if compromised and should not be used for routine email and browsing.
- ✓External sharing, mailbox forwarding and third-party application consent can expose information when left unreviewed.
- ✓Microsoft 365 service availability does not replace a documented retention and recovery decision for business data.
Checklist
- ✓Confirm ownership of the tenant, domains, billing, emergency access and administrator accounts.
- ✓Enable multi-factor authentication and use separate, least-privileged administrator accounts.
- ✓Review active users, guests, groups, forwarding rules, shared mailboxes and third-party application access.
- ✓Configure device and application access according to the organisation’s licence and risk requirements.
- ✓Set external-sharing rules for SharePoint, OneDrive and Teams, and explain them to users.
- ✓Document retention, backup, incident response and staff-leaver procedures, then test them.
Expected benefits
✓Better control of identities and sharing
✓Documented recovery responsibilities
✓A repeatable administration review